{"record":{"id":"332b24a84ca60321","repo":"passbolt/passbolt_api","slug":"this-is-not-a-valid-ajax-json-request-332b24","errorCode":null,"errorMessage":"This is not a valid Ajax/Json request.","messagePattern":"This is not a valid Ajax/Json request\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Controller/OrgSettings/MfaOrgSettingsGetController.php","lineNumber":35,"sourceCode":"namespace Passbolt\\MultiFactorAuthentication\\Controller\\OrgSettings;\n\nuse Cake\\Http\\Exception\\BadRequestException;\nuse Passbolt\\MultiFactorAuthentication\\Controller\\MfaController;\nuse Passbolt\\MultiFactorAuthentication\\Utility\\MfaOrgSettingsDuoBackwardCompatible;\n\nclass MfaOrgSettingsGetController extends MfaController\n{\n    /**\n     * Handle Org Settings get request\n     *\n     * @return void\n     */\n    public function get()\n    {\n        $this->User->assertIsAdmin();\n\n        if (!$this->request->is('json')) {\n            throw new BadRequestException(__('This is not a valid Ajax/Json request.'));\n        }\n        $config = $this->mfaSettings->getOrganizationSettings()->getConfig();\n        /** TODO: Remove this line and its class once the frontend has been updated to use the new format/names */\n        $config = MfaOrgSettingsDuoBackwardCompatible::remapGetDuoSettings($config);\n\n        $this->success(__('The operation was successful.'), $config);\n    }\n}\n","sourceCodeStart":17,"sourceCodeEnd":44,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Controller/OrgSettings/MfaOrgSettingsGetController.php#L17-L44","documentation":"The MFA organization settings GET endpoint is a JSON-only admin API. MfaOrgSettingsGetController::get asserts the request is JSON (after admin authorization) and throws BadRequestException for plain HTML/browser requests, because it returns configuration data rather than a page.","triggerScenarios":"GET /mfa/settings without the .json extension or without JSON Accept headers, even when authenticated as admin.","commonSituations":"Opening the endpoint in a browser; scripts omitting the .json suffix; proxies stripping Accept headers.","solutions":["Request /mfa/settings.json or send Accept: application/json","Ensure the caller is an admin (assertIsAdmin runs first and fails otherwise)","Use the admin UI for interactive organization settings management"],"exampleFix":"// before\nawait fetch('/mfa/settings');\n// after\nawait fetch('/mfa/settings.json', {headers:{Accept:'application/json'}});","handlingStrategy":"validation","validationCode":"if (!url.endsWith('.json')) url += '.json';\nheaders['Accept'] = 'application/json';","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use .json for settings APIs","Ensure the session is admin before calling org settings endpoints","Use a typed API client wrapper for settings calls"],"tags":["mfa","org-settings","http-400","ajax"],"backgroundTag":"invalid-argument-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}